GO-2020-0009
- Source
- https://pkg.go.dev/vuln/GO-2020-0009
- Import Source
- https://vuln.go.dev/ID/GO-2020-0009.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2020-0009
- Aliases
- Published
- 2021-04-14T20:04:52Z
- Modified
- 2024-05-20T16:03:47Z
- Summary
- Integer overflow in github.com/square/go-jose
- Details
-
On 32-bit platforms an attacker can manipulate a ciphertext encrypted with AES-CBC with HMAC such that they can control how large the input buffer is when computing the HMAC authentication tag. This can can allow a manipulated ciphertext to be verified as authentic, opening the door for padding oracle attacks.
- Database specific
{ "url": "https://pkg.go.dev/vuln/GO-2020-0009", "review_status": "REVIEWED" }- References
- Credits
-
-
- Quan Nguyen from Google's Information Security Engineering Team
-
Affected packages
Go / github.com/square/go-jose
Package
- Name
- github.com/square/go-jose
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/square/go-jose
Affected ranges
- Type
- SEMVER
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.0.0-20160903044734-789a4c4bd4c1
Ecosystem specific
{
"imports": [
{
"symbols": [
"cbcAEAD.Open",
"cbcAEAD.Seal",
"cbcAEAD.computeAuthTag"
],
"goarch": [
"386",
"arm",
"armbe",
"amd64p32",
"mips",
"mipsle",
"mips64p32",
"mips64p32le",
"ppc",
"riscv",
"s390",
"sparc"
],
"path": "github.com/square/go-jose/cipher"
},
{
"symbols": [
"JsonWebEncryption.Decrypt",
"genericEncrypter.Encrypt",
"genericEncrypter.EncryptWithAuthData"
],
"goarch": [
"386",
"arm",
"armbe",
"amd64p32",
"mips",
"mipsle",
"mips64p32",
"mips64p32le",
"ppc",
"riscv",
"s390",
"sparc"
],
"path": "github.com/square/go-jose"
}
]
}